This week, Tanium’s Cyber Threat Intelligence (CTI) team investigates a new campaign involving the BlackSuit ransomware group. Next, the team looks at AsyncRAT’s evolution into a complex web of forks. Finally, we wrap up with an overview of HazyBeacon, a previously undocumented Windows backdoor.
Inside BlackSuit ransomware operations: Dual threat of encryption and data theft
A recent blog post from Cybereason provides an in-depth analysis of a ransomware campaign conducted by the BlackSuit ransomware group.
What is BlackSuit ransomware?
BlackSuit is a sophisticated ransomware operation believed to be a rebrand of the Royal group (an offshoot of the infamous Conti gang), which indicates a high level of operational maturity and threat capability.
BlackSuit’s campaigns combine data exfiltration with file encryption, maximizing leverage over victims.
[How to negotiate with ransomware actors: Lessons from a top negotiator]
How does BlackSuit infiltrate and move through networks?
Cybereason observed BlackSuit using tools like PsExec, Cobalt Strike, RDP, and rclone to gain initial access, move laterally, and maintain persistence.
In one observed attack, PsExec was used to deploy Cobalt Strike Beacons remotely, while RPC was leveraged to create remote services. This is an uncommon but notable tactic.
What are BlackSuit’s command and control (C2) techniques?
As Cybereason notes, the attackers rely heavily on PowerShell commands to connect to their C2 infrastructure. The attackers download payloads including Cobalt Strike Beacon and the ransomware binary from both external and compromised internal IPs, complicating detection.
This dual-source approach complicates detection and highlights the group’s adaptability.
How does BlackSuit escalate its attacks after gaining access?
Once inside a network, BlackSuit uses Rundll32.exe to load Cobalt Strike Beacons and connect to malicious domains. It then dumps credentials via LSASS, exfiltrates data using a renamed rclone binary (vmware.exe), and deletes shadow copies to prevent recovery.
The group sets exclusion paths to avoid encrypting system-critical files and its own ransom notes, reinforcing its stealthy and strategic approach.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Threat actors are increasingly blurring the line between red team tactics/legitimate activity and real-world cybercrime, as evidenced by BlackSuit’s use of legitimate tools like rclone and Cobalt Strike.
What’s interesting about this group is its lineage, which traces from Conti to Royal to BlackSuit. This kind of rebranding and adaptation is common among threat actor groups and makes attribution particularly challenging.
The rise of AsyncRAT forks in open-source malware
According to ESET, the open-source remote access trojan AsyncRAT has evolved into a complex web of forks, each tailored with unique features.
By tracing its lineage and plugin diversity, researchers highlight AsyncRAT’s adaptability and its persistent threat to cybersecurity.
What is AsyncRAT and why is it so widely forked?
The original AsyncRAT was released to GitHub in 2019. It comes with capabilities for keylogging, screen capturing, credential theft, and much more.
Since the malware is open source, it’s widely popular among threat actors and has led to several forks. These forks are tied together by the custom cryptography classes used by the malware.
ESET notes that while AsyncRAT shares cryptographic components with Quasar RAT—such as identical Aes256 and Sha256 classes—it is not a direct fork but a complete rewrite. Its modular architecture and stealth enhancements make it more evasive and harder to detect, contributing to its popularity among threat actors.
How does ESET identify AsyncRAT forks in the wild?
ESET used a variety of methods to identify and categorize samples. The easiest way to identify these forks was to look at the malware’s configuration.
For most of the samples, ESET found that the “version” field in the configuration was helpful, containing either the fork’s name itself or the malware author. In some cases that field was blank, and researchers had to look elsewhere for clues like the Salt value for encryption.
ESET also gathered insights by looking for the certificate used to authenticate the C2 server, which could sometimes be traced back to the previous fork.
How are AsyncRAT variants like DcRAT and VenomRAT connected?
According to ESET, the most widely used AsyncRAT variants are DcRAT and VenomRAT.
DcRAT was built upon AsyncRAT, introducing additional features and capabilities, while VenomRAT is believed to have been inspired by DcRAT.
Beyond these, numerous lesser-known forks are also in circulation, which ESET explores in greater detail.
What makes lesser-known AsyncRAT variants worth watching?
ESET has identified several lesser-known AsyncRAT forks that introduce capabilities beyond standard RAT behavior, including:
SantaRATBoraRATNonEuclid RATScreamer.dllPiano.dllService.dllMaps.dllWormUsb.dll
While some, such as SantaRAT and BoraRAT, appear to be joke variants, others—like Screamer.dll and WormUsb.dll—feature distinctive plugins such as USB spreaders and novelty payloads.
These examples showcase the flexibility of AsyncRAT’s open-source framework and the creativity, sometimes even humor, of its user base.
For those interested in a deeper technical breakdown, ESET’s full report is well worth a read.
Analyst comments from Tanium’s Cyber Threat Intelligence team
ESET’s research is eye-opening. Much has been said about how variants stem from other malware, but seeing how many forks exist from a single AsyncRAT trojan really puts this into perspective.
The sheer number of AsyncRAT forks presents a challenge for defenders, as signature-based detection can struggle to keep pace with the evolving landscape. This research also highlights the double-edged nature of open-source software that can be great for collaboration but also enable actors to weaponize tools with ease.
More CTI roundups featuring AsyncRAT
AsyncRAT has appeared in several threat campaigns tracked by Tanium’s Cyber Threat Intelligence team. For additional context on how it’s being deployed alongside other malware and infrastructure abuse, check out these blog posts:
- AsyncRAT, PikaBot malware, and MS SQL servers under attack (Published January 18, 2024): Highlights a new campaign delivering AsyncRAT via phishing pages and obfuscated JavaScript loaders, alongside PikaBot distribution and MS SQL server exploitation
- DOJ cyber unit pursues state-sponsored threats (Published June 27, 2023): Explores AsyncRAT's presence in campaigns linked to nation-state actors and infrastructure abuse, including expired AWS S3 buckets
- ESXiArgs ransomware attacks target VMware (Published February 14, 2023): Discusses AsyncRAT's use in pre-ransomware staging activity and its role in campaigns targeting unpatched VMware ESXi servers
Stay tuned for future CTI updates and campaign breakdowns as our team continues tracking AsyncRAT and its evolving variants across the threat landscape.
HazyBeacon malware exploits AWS Lambda for stealthy government espionage
Palo Alto recently discovered a novel Windows backdoor, dubbed HazyBeacon, that exemplifies the growing trend of adversaries abusing cloud-native infrastructure for stealthy C2 operations.
This malware is linked to a threat cluster CL-STA-1020 targeting government entities in Southeast Asia, with a focus on intelligence collection.
Abusing AWS Lambda URLs for covert command and control
HazyBeacon leverages AWS Lambda, a serverless computing service that executes code in response to events without requiring server provisioning or management. In 2022, Lambda URLs were introduced to extend this functionality—allowing developers to invoke Lambda functions via HTTP endpoints. However, this convenience has been co-opted by threat actors, who now use Lambda URLs as C2 channels.
By embedding beaconing activity within legitimate-looking cloud traffic, attackers can blend malicious communication with normal enterprise operations, making detection significantly more difficult.
Stealthy deployment via DLL sideloading and persistent services
To infiltrate systems, HazyBeacon uses DLL sideloading to disguise a malicious DLL as a legitimate Windows library to execute its payload.
Once executed, it connects to the attacker-controlled Lambda endpoint. For persistence, the malware installs a Windows service named msdnetsvc.
Targeted file collection and cloud-based exfiltration attempts
One of the key payloads, igfx.exe, is a file collector that zips targeted files based on specified extensions and time ranges. The actor then fragments the archive into smaller parts for exfiltration. Tools like GoogleGet.exe were used to attempt uploads to Google Drive and Dropbox, though these were ultimately blocked.
Post-exfiltration cleanup to minimize detection
After the data collection phase, the attacker executed cleanup commands to erase payloads and archives, minimizing forensic traces.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The use of AWS Lambda URLs for C2 communication highlights how cloud services are increasingly being leveraged by threat actors to mask malicious activity within trusted infrastructure—making traditional perimeter-based defenses less effective.
HazyBeacon represents the broader trend in advanced persistent threat (APT) tactics in which actors are moving away from static infrastructure towards cloud infrastructure. This activity reiterates the need for defenders to adopt more behavior-based detection strategies.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.